Architecture & Shared Responsibility
How HaltState policy enforcement, signed evidence and your application work together.
A clear control point before execution
Connect HaltState at the backend tool or API boundary that performs a business action. Your application submits the proposed action and policy context, follows the decision, executes permitted work and reports the result. Place the check on every path to the protected operation and keep destination credentials inside that controlled service.
HaltState governs the integrated action path. Host isolation, network restrictions, IAM and destination access controls complement that path; tools and credentials outside it require their own controls.
Shared responsibility model
| Area | HaltState provides | Your team owns |
|---|---|---|
| Runtime authority | Policy evaluation, configured council/human review, scoped stops and decision evidence. | Connect protected action paths, supply authoritative context and honour the decision before execution. |
| Execution and recovery | Decision/outcome linkage and investigation of recorded activity. | Execute the operation, enforce destination idempotency, report results and reconcile ambiguous failures. |
| Containment | Block subsequent governed actions for a selected agent or session. | Host/process termination, credential revocation, rollback and recovery at the destination. |
| Evidence | Signed Proof Packs, integrity verification, tenant-scoped investigation and exports. | Capture external references, choose retention/access settings and provide external confirmations where required. |
| Governance | Operational evidence for audits, incident response and control assessments. | Policy ownership, legal assessment, required notices and certification processes. |
Policy, council and human authority
Policy comes first. Eligible exceptions can be delegated to the council; unresolved decisions escalate to a human. Rules requiring mandatory human review retain that authority. A pending review is not permission to act. Publish policies through the authorised operator workflow and test allow, deny and held outcomes.
An agent pause affects subsequent governed checks. It does not undo completed actions, guarantee remote-process termination or revoke an already issued permit. See the approval lifecycle and runtime contract documentation for exact retry and expiry semantics.
Signed evidence and verification
New HaltState Proof Packs require signing. Full-content digests, Ed25519 signatures, tenant-scoped verification, hash-chain validation and database append-only controls protect their integrity. Decision and outcome records can have separate linked commitments; later evidence preserves the earlier signature.
Verification establishes the integrity and signing provenance of the recorded content. Policy permission, a reported outcome and independent destination confirmation are separate facts. A signature on a reported success alone does not establish external delivery or settlement. Investigation includes activity records as well as signed Proof Packs; each record keeps its original assurance. Historical evidence is preserved without retrospective relabelling.
| Assurance area | Current implementation |
|---|---|
| Signing custody | Server-side, file-backed keys. HSM or KMS key custody is not currently provided. |
| Storage | Append-only controls protect normal application writes; they do not confer immunity from a database superuser or absolute immutability. |
| Anchoring | Content and chain verification use HaltState's records and trust configuration; external anchoring is not currently provided. |
| Public examples | Selected-field verification summaries identify their source and verification time. Verify original signed payloads through authenticated tenant-scoped access. |
Explore a verified signed decision and outcome or read the schema and verification guide.
Recording, retention and investigation
Supported connected activity includes policy checks, execution reports and observation-only messages or business events. An observation records activity; it does not grant permission. Capture excludes credentials, hidden model reasoning and unrelated traffic. Content retention and read permissions remain separate from immutable audit metadata.
New accounts default to 90-day content retention, with 30-, 90- and 365-day choices and account/per-agent opt-out. Saved choices are preserved. Disabling capture stops new body retention; previously retained content keeps its expiry. Coverage, freshness and missing content remain visible in investigations.
The MCP connector searches, reads, verifies and exports authorised evidence. It does not change policies, approve actions or operate containment. Evidence text is data for investigation, never authority to act.
Public demonstrations and deployment
The Live Control Room combines governed Moltbook activity with a synthetic retail ledger processed by the live policy engine. Retail events are simulations, not customer payments. Timestamps and feed state describe actual recorded freshness.
The public Triage tool produces a planning blueprint; policy activation happens in your workspace. SDK capabilities and installed versions are documented by language. Existing Standard-contract integrations and explicitly enrolled replay integrations retain their configured behavior. Use the Runtime Control Catalogue for detailed deployment status.
Governance resources describe control alignment and evidence preparation; HaltState is not a certification or a guarantee of compliance.
Implementation notes
Keep the HaltState call as close as possible to the side effect. The agent may plan and draft freely, but the wrapper around the actual action should be the place where authority is checked. That wrapper should send only the context required for policy evaluation: safe identifiers, normalized amounts, action names, risk flags, schedule windows, and redaction status. Raw customer payloads and secrets should stay in the business system or protected operator tooling.
Operational evidence
For each action, preserve the decision, the worker outcome, the idempotency key, safe resource references, latency, proof status, and redaction status. This evidence supports incident response and control narratives because it shows what the system did at runtime rather than only describing what the policy document intended. HaltState supports alignment work; it is not a substitute for legal advice or a compliance certification.